Hack 60. Force Gmail to Use a Secure Connection

Protect your inbox by automatically redirecting Gmail to an https:// address.

You can use Google's web mail service through an unsecured connection (an http:// address) or a secure connection (an https:// address). When I'm out and about and browsing the Web on an untrusted network (such as an Internet cafe), I try to remember to use the https:// address. But why bother remembering, when Greasemonkey can remember it for me?

7.2.1. The Code

This user script is literally one line of code. The reason it can be so small is that we configure it to run only on http://mail.google.com, the insecure address of Gmail.

Save the following user script as securewebmail.user.js:

 // ==UserScript== // @name          Secure Webmail // @namespace   http://diveintomark.org/projects/greasemonkey/ // @description   force webmail to use secure connection // @include   http://mail.google.com/* // ==/UserScript== window.location.href = window.location.href.replace(/^http:/, 'https:'); 

7.2.2. Running the Hack

After installing the user script (Tools Install This User Script), go to http://mail.google.com/mail. Your browser will automatically redirect to https://mail.google.com/mail. Firefox will change the background color of the location bar to pale yellow (as shown in Figure 7-1) to indicate that you are now browsing a secure site.

Figure 7-1. A secure connection to Gmail

7.2.3. Hacking the Hack

Many online applications offer the same service on an http:// or an https:// address. This script will work unmodified on any such site. There is nothing Gmail-specific about the code itself; all it does is redirect from an http:// address to the corresponding https:// address.

If you use Yahoo! Mail instead of (or in addition to) Gmail, all you need to do is change the script's configuration to tell Greasemonkey to run the script when you visit Yahoo! Mail. Under the Tools menu, select Manage User Scripts. In the list of scripts, select Gmail Secure. You will see the current configuration of where the script should run. Under "Included pages," click Add…and type http://mail.yahoo.com/*, as shown in Figure 7-2.

Now, visit Yahoo! Mail at http://mail.yahoo.com. You will immediately be redirected to https://mail.yahoo.com, and you can sign in to Yahoo! Mail securely.

Figure 7-2. Secure Yahoo! Mail configuration